[codex] add duplicati backup status to landingpage (#94)

* feat: add duplicati backup status to landingpage

* fix: strip duplicati prefix before n8n proxy

* fix: use duplicati namespaced webhook path

* fix: require mTLS for duplicati webhook endpoints

* fix: replace invalid handle_path matcher usage

* refactor: use standard webhook auth flow for duplicati

* refactor: simplify landing duplicati status path

* fix: switch landing backup status paths to generic backup endpoints

* feat: show backup dashboard list on landing page

* fix: revert telegram reissue matcher change

* fix: narrow landing backup proxy routes to explicit endpoints

* fix: restore telegram webhook secret header matcher

* fix: prevent xss in backup list rendering

* test: enforce auth-protected endpoint policy in CI

* test: add isolated e2e auth endpoint checks

* fix: make auth tests portable and dclint-compliant

---------

Co-authored-by: sidey79 <sidey79>

Author: sidey79

.github/workflows/lint.yml

@@ -46,3 +46,23 @@ jobs:
             -v "$RUNNER_TEMP/caddy-ca/private:/etc/ssl/ca/private:ro" \
             -w /work \
             "$CADDY_IMAGE" sh -lc 'caddy validate --config /work/caddy/Caddyfile'
+
+  endpoint-authz-policy:
+    name: runner / endpoint-authz-policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+      - name: Verify auth-protected endpoint policy
+        run: |
+          bash scripts/test-auth-protected-endpoints.sh caddy/Caddyfile
+
+  endpoint-authz-e2e:
+    name: runner / endpoint-authz-e2e
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+      - name: Run E2E auth endpoint checks
+        run: |
+          bash scripts/test-auth-endpoints-e2e.sh

caddy/Caddyfile

@@ -275,12 +275,30 @@ landing.{$CADDY_SUBDOMAIN} {
 		method GET HEAD
 		path /api/me
 	}
+	@landingBackupStatus {
+		method GET HEAD
+		path /backup/status
+	}
+	@landingBackupNames {
+		method GET HEAD
+		path /backup/names
+	}
 	route {
 		handle @landingApiMe {
 			import authelia_forward_auth
 			rewrite * /webhook/landing/api/me
 			import n8n_upstream
 		}
+		handle @landingBackupStatus {
+			import authelia_forward_auth
+			rewrite * /webhook/backup/status-public
+			import n8n_upstream
+		}
+		handle @landingBackupNames {
+			import authelia_forward_auth
+			rewrite * /webhook/backup/names
+			import n8n_upstream
+		}
 		handle {
 			import authelia_forward_auth
 			root * /srv/landingpage

scripts/test-auth-endpoints-e2e.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+COMPOSE_FILE="$ROOT_DIR/tests/e2e/docker-compose.e2e.yml"
+BASE_URL="http://127.0.0.1:18080"
+
+cleanup() {
+  docker compose -f "$COMPOSE_FILE" down -v --remove-orphans >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+req_code() {
+  local method="$1" host="$2" path="$3" auth="$4" extra_header="${5:-}"
+  local -a args=( -sS -o /dev/null -w "%{http_code}" -X "$method" -H "Host: $host" )
+  if [[ "$auth" == "auth" ]]; then
+    args+=( -H "X-Test-Auth: allow" )
+  fi
+  if [[ -n "$extra_header" ]]; then
+    args+=( -H "$extra_header" )
+  fi
+  curl "${args[@]}" "$BASE_URL$path"
+}
+
+req_header() {
+  local method="$1" host="$2" path="$3" auth="$4" header_name="$5" extra_header="${6:-}"
+  local -a args=( -sS -D - -o /dev/null -X "$method" -H "Host: $host" )
+  if [[ "$auth" == "auth" ]]; then
+    args+=( -H "X-Test-Auth: allow" )
+  fi
+  if [[ -n "$extra_header" ]]; then
+    args+=( -H "$extra_header" )
+  fi
+  curl "${args[@]}" "$BASE_URL$path" | awk -v h="$header_name" 'BEGIN{IGNORECASE=1} $0 ~ "^"h":" {print; found=1} END{if(!found) exit 1}'
+}
+
+assert_eq() {
+  local got="$1" want="$2" msg="$3"
+  if [[ "$got" != "$want" ]]; then
+    echo "FAIL: $msg (got=$got want=$want)" >&2
+    exit 1
+  fi
+  echo "OK: $msg -> $got"
+}
+
+assert_no_upstream_header() {
+  local method="$1" host="$2" path="$3" auth="$4"
+  if req_header "$method" "$host" "$path" "$auth" "X-Upstream" >/dev/null 2>&1; then
+    echo "FAIL: unexpected upstream proxy for $host$path" >&2
+    exit 1
+  fi
+  echo "OK: no upstream proxy header for $host$path"
+}
+
+echo "Starting isolated E2E stack..."
+docker compose -f "$COMPOSE_FILE" up -d --wait
+
+# landing.* protected endpoints
+assert_eq "$(req_code GET landing.test /backup/status none)" "401" "landing /backup/status requires auth"
+assert_eq "$(req_code GET landing.test /backup/status auth)" "200" "landing /backup/status works with auth"
+assert_eq "$(req_code GET landing.test /backup/names none)" "401" "landing /backup/names requires auth"
+assert_eq "$(req_code GET landing.test /backup/names auth)" "200" "landing /backup/names works with auth"
+assert_eq "$(req_code GET landing.test /api/me none)" "401" "landing /api/me requires auth"
+assert_eq "$(req_code GET landing.test /api/me auth)" "200" "landing /api/me works with auth"
+
+# Ensure no broad /backup/* passthrough remains
+assert_eq "$(req_code GET landing.test /backup/rest/workflows auth)" "404" "landing /backup/rest/workflows is not proxied"
+assert_no_upstream_header GET landing.test /backup/rest/workflows auth
+
+# workflow.* protected webhook path
+assert_eq "$(req_code POST workflow.test /webhook/protected none)" "401" "workflow protected webhook requires auth without mTLS/exception"
+assert_eq "$(req_code POST workflow.test /webhook/protected auth)" "200" "workflow protected webhook works with auth"
+
+# Explicit Telegram exception (no auth but header secret)
+assert_eq "$(req_code POST workflow.test /webhook/scanservjs/telegram/reissue none "X-Telegram-Bot-Api-Secret-Token: test-telegram-secret")" "200" "telegram exception works without auth when secret header matches"
+assert_eq "$(req_code POST workflow.test /webhook/scanservjs/telegram/reissue none)" "401" "telegram path without secret remains protected"
+
+echo "All E2E auth endpoint checks passed."

scripts/test-auth-protected-endpoints.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CADDYFILE="${1:-caddy/Caddyfile}"
+
+if [[ ! -f "$CADDYFILE" ]]; then
+  echo "ERROR: Caddyfile not found: $CADDYFILE" >&2
+  exit 1
+fi
+
+fail() {
+  echo "ERROR: $*" >&2
+  exit 1
+}
+
+has_fixed_string() {
+  local pattern="$1"
+  local file="$2"
+  if command -v rg >/dev/null 2>&1; then
+    rg -n --fixed-strings "$pattern" "$file" >/dev/null
+  else
+    grep -nF -- "$pattern" "$file" >/dev/null
+  fi
+}
+
+require_pattern() {
+  local pattern="$1"
+  local msg="$2"
+  if ! has_fixed_string "$pattern" "$CADDYFILE"; then
+    fail "$msg"
+  fi
+}
+
+forbid_pattern() {
+  local pattern="$1"
+  local msg="$2"
+  if has_fixed_string "$pattern" "$CADDYFILE"; then
+    fail "$msg"
+  fi
+}
+
+# Landing host must expose only narrow backup aliases and protect them via Authelia.
+require_pattern "path /backup/status" "Missing landing alias /backup/status"
+require_pattern "path /backup/names" "Missing landing alias /backup/names"
+forbid_pattern "path /backup/*" "Broad /backup/* alias is forbidden on landing host"
+require_pattern "rewrite * /webhook/backup/status-public" "Missing rewrite for /backup/status"
+require_pattern "rewrite * /webhook/backup/names" "Missing rewrite for /backup/names"
+require_pattern "handle @landingBackupStatus {" "Missing landingBackupStatus handle"
+require_pattern "handle @landingBackupNames {" "Missing landingBackupNames handle"
+
+# Workflow host webhook protections must remain explicit.
+require_pattern 'header X-Telegram-Bot-Api-Secret-Token {$TELEGRAM_WEBHOOK_SECRET}' 'Missing Telegram secret header matcher'
+require_pattern "path /webhook/scanservjs/telegram/reissue /webhook-test/scanservjs/telegram/reissue" "Missing Telegram webhook path matcher"
+require_pattern "handle @webhooksAuthelia {" "Missing Authelia webhook handling branch"
+require_pattern "import authelia_forward_auth" "Missing authelia_forward_auth import"
+
+# Quick structural sanity for webhook mTLS split (must both exist).
+require_pattern "@webhooksMtls {" "Missing mTLS webhook matcher"
+require_pattern "@webhooksAuthelia {" "Missing non-mTLS webhook matcher"
+
+echo "Auth endpoint policy checks passed: $CADDYFILE"

site/landingpage/app.js

@@ -86,6 +86,90 @@ function renderFallback(error) {
   rolePill.textContent = "family";
 }
 
+function mapStatusLabel(status) {
+  const map = {
+    ok: "Backup OK",
+    warn: "Backup mit Warnungen",
+    error: "Backup fehlgeschlagen",
+    unknown: "Backupstatus unbekannt",
+  };
+  return map[status] || map.unknown;
+}
+
+function renderBackupStatusList(payload) {
+  const statusTarget = document.getElementById("backup-status");
+  const listTarget = document.getElementById("backup-list");
+  if (!statusTarget || !listTarget) return;
+
+  const backups = Array.isArray(payload?.backups) ? payload.backups : [];
+
+  if (!backups.length) {
+    statusTarget.textContent = "Keine Backupdaten vorhanden.";
+    listTarget.replaceChildren();
+    return;
+  }
+
+  const latestTs = backups
+    .map((b) => (b.lastCheckedAt ? Date.parse(b.lastCheckedAt) : 0))
+    .reduce((max, ts) => (ts > max ? ts : max), 0);
+  const latestText = latestTs ? new Date(latestTs).toLocaleString("de-DE") : "keine Daten";
+
+  statusTarget.textContent = `Backups: ${backups.length} • Letztes Update: ${latestText}`;
+
+  listTarget.replaceChildren();
+  backups.forEach((backup) => {
+    const name = backup.backupName || "unbekannt";
+    const label = mapStatusLabel(backup.status);
+    const checkedAt = backup.lastCheckedAt ? new Date(backup.lastCheckedAt).toLocaleString("de-DE") : "keine Daten";
+
+    const li = document.createElement("li");
+    const strong = document.createElement("strong");
+    strong.textContent = name;
+    li.appendChild(strong);
+    li.appendChild(document.createTextNode(`: ${label} • Stand: ${checkedAt}`));
+    listTarget.appendChild(li);
+  });
+}
+
+async function loadBackupStatus() {
+  const target = document.getElementById("backup-status");
+  const listTarget = document.getElementById("backup-list");
+
+  try {
+    const response = await fetch("/backup/names", {
+      credentials: "same-origin",
+      headers: {
+        Accept: "application/json",
+      },
+      cache: "no-store",
+    });
+
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}`);
+    }
+
+    const contentType = response.headers.get("content-type") || "";
+    if (!contentType.includes("application/json")) {
+      const text = await response.text();
+      throw new Error(
+        `Unerwartete Antwort (${contentType || "kein Content-Type"}). ` +
+        `Haeufige Ursache: Landing/Proxy liefert HTML statt /backup/names-JSON. ` +
+        `Vorschau: ${text.slice(0, 80)}`
+      );
+    }
+
+    const payload = await response.json();
+    renderBackupStatusList(payload);
+  } catch (error) {
+    if (target) {
+      target.textContent = `Backupstatus konnte nicht geladen werden (${error instanceof Error ? error.message : String(error)})`;
+    }
+    if (listTarget) {
+      listTarget.replaceChildren();
+    }
+  }
+}
+
 async function loadProfile() {
   try {
     const response = await fetch("/api/me", {
@@ -110,3 +194,4 @@ async function loadProfile() {
 initializeThemeToggle();
 hydrateLinks();
 loadProfile();
+loadBackupStatus();

site/landingpage/index.html

@@ -130,6 +130,8 @@ <h2>Admin</h2>
         <div class="section-head">
           <h2>Hinweis</h2>
         </div>
+        <p id="backup-status">Backup-Status wird geladen ...</p>
+        <ul id="backup-list"></ul>
         <p>
           Diese Seite blendet nur Links ein oder aus. Die Zielsysteme muessen weiterhin selbst ueber
           Authelia, mTLS oder eigene Anmeldung geschuetzt bleiben.